osquery #kolide

fritz

01/15/2020, 8:34 PM

Hey guys there was a recent announcement by the NSA regarding a critical Windows Cryptographic vulnerability. I wrote up a blog-post on finding affected machines: https://blog.kolide.com/using-kolide-osquery-to-find-and-fix-critical-windows-crypto-vulnerability-b6c05e33a9cf

kolide 2

🦜 3

👍 3

killahquam

01/15/2020, 9:45 PM

anyone exposing fleet to the outside, if so how are you separating the admin portal from the clients

seph

01/16/2020, 3:07 PM

Hi All! I have a request from the community to shift the packaged linux install locations from

/usr/local

/opt

. This would change for people who use the

package-builder

tool. Anyone want to comment for or against it?

Jay

01/21/2020, 1:09 AM

i can not add windows client to kolide fleet,who can help me?

Jean M

01/22/2020, 12:08 PM

Hi, I’m trying to use fleet with scheduled packs, followed the FAQ instructions but, 1) in the host osquery_schedule contains only the entry that is in the host osquery configuration file (system_info), 2) in fleet I only see requests for methods GetDistributedQueries and AuthenticateHost (from the daemon log), not sure how osquery updates its list of scheduled queries with what is configured in fleet? if anyone has any idea to help debug..please let me know

AoS

01/27/2020, 12:56 PM

Is there a

/isalive

api for Fleet?

Jason W

01/28/2020, 6:30 PM

Hi - I have an odd message in my launcher logs (using the github kolide). Anyone have an idea of what might be causing this? Even just a point in the right direction would be fantastic.

Copy code

{
  "caller": "query_target.go:75",
  "err": "fetching target memberships: rpc error: code = Unknown desc = OK: HTTP status code 200; transport: received the unexpected content-type \"text/html; charset=utf-8\"",
  "msg": "updating kolide_target_membership data",
  "severity": "error",
  "ts": "2020-01-28T18:28:29.977507Z"
}

Tim

01/29/2020, 7:16 PM

Is it just me or is anyone else having issues with the 2.5.0 zip? The checksum does not match

Copy code

wget -O /home/centos/fleet.zip <https://github.com/kolide/fleet/archive/2.5.0.zip>
sha256sum fleet.zip
a18e243746b21b701d7f47278524d92ee9d8ccd25e17e25d8472ac36cb667de1  fleet.zip

from what is says online the checksum should be f609a992ddd7a09c70b94771d1995aa63bbaa772ce32d26a219d634de95e7a24

jackjack

02/03/2020, 10:39 PM

Hey Channel. Does your free version support Okta saml2.0?

jackjack

02/03/2020, 10:40 PM

Thank you for any help you can provide :)

Jason W

02/04/2020, 3:04 PM

I have a mix of Mac, Windows, and Linux endpoints. The server platform itself doesn’t matter too much. Sorry, I’m more of a linux person so I can’t help too much with custom windows services, but getting it set up on linux is very easy.

Jean M

02/04/2020, 3:09 PM

Hi, does anyone know if it is possible to get the hosts that were used as target in a live query from Fleet logs? I can only find this NewDistributedQueryCampaign message but it only contains the number of hosts? (I guess this is on purpose)

fbone

02/04/2020, 8:22 PM

Cannot seem to get my Windows client to enroll into Fleet, I can access the Fleet login GUI page from my windows box, so firewall should not be an issue. Yet every time I try to check enrollment, I receive Cannot Read TLS Server certificate

jackjack

02/04/2020, 9:03 PM

Copy code

{"component":"service","err":"invalid enroll secret","ip_addr":"10.96.12.239:64947","method":"EnrollAgent","took":"403.333µs","ts":"2020-02-04T21:00:05.977721805Z"}
{"component":"service","err":"authentication error: missing node key","ip_addr":"10.96.12.239:64947","method":"AuthenticateHost","took":"4.18µs","ts":"2020-02-04T21:00:06.261929944Z"}
{"component":"http","err":"authentication error: missing node key","ts":"2020-02-04T21:00:06.261985496Z"}

fbone

02/04/2020, 9:08 PM

funny I have invalid enroll secret as well

Frank Louwers

02/06/2020, 2:30 PM

Is there a quick overview of the diffs between Fleet and K2? (Besides saas vs self-hosted)?

darren

02/06/2020, 3:06 PM

is it possible to read the contents of a file with osquery. context is we are currently dumping mdm enrolment date as a int value into a file. i just want to be able to read that value within the file

fritz

02/06/2020, 3:16 PM

Hi @Frank Louwers, they are effectively two totally different products. There is a common misconception that K2 is simply a hosted version of Kolide Fleet but other than their mutual utilization of Launcher (https://github.com/kolide/launcher) and osquery they have little to no overlap in code. K2 was a rewrite from the ground up, built around the desire to provide a User Focused Security platform. This meant providing an avenue to notify and educate end-users on security best practices. K2 still retains the core functionality of Fleet with access to osquery power-user tools such as: • Live Query • Query Packs • Decorators • Configurable Osquery Options • Configurable Log Output It seeks to improve upon each of those features and further refine their experiences (for example Live Query reports errors of malformed or incomplete queries per device). The expansion of features include: • Automatic Device to User Assignment (across all 3 platforms) • Integration with G Suite / Slack • Built-in notification functionality (including reaching out to end users with self-fix instructions) • Persistently browsable and enriched data via a feature we call Inventory (eg. What chrome extensions are installed across my environment? Without having to run a Live Query or rebuild log output) • Prebuilt packages that automatically enroll into the environment • Automatic Slack-based onboarding (Helpful for organizations that do not have a software distribution method) • Dedicated Support • Audit Logging • A dedicated Privacy Center, which allows end-users to see what data from their device is being collected by the osquery agent, and who in their organization has access to that data If you have run Fleet already, the easiest way to see the differences, is by signing up for a trial and enrolling a small test suite of devices in K2. We don't require any payment method up front, so you can noodle around for 30 days to get a better idea of which is a better fit for your environment. https://k2.kolide.com/signup

darren

02/06/2020, 3:19 PM

Okay cool, thanks for the info 🙂

👍 1

calve

02/06/2020, 4:59 PM

Hi there. Am I right to think that when running kolide/fleet, both the osquery tls remote interface and the web administration interface are served on the same TCP port (8080 per the documentation defaults) ? Am I missing an option to configure different tcp ports to each of those service ?

Martin Westergaard Lassen

02/11/2020, 11:53 AM

Hi! Is there a way to append the device owners email address to the live query CSV export? Currently I'm only getting the

device_owner

column

gberthome

02/11/2020, 12:58 PM

Hi! I'm trying to access the Kolide API from using Postman. I found my API token, but I don't really know how to use it... 😕 Header ? Authorization ? Can anyone help me ? Thanks !

Gavin

02/13/2020, 12:09 AM

Does fleet server does a prescribed log format for the result & status the use case is for parsing the logs outside of fleet

R0n

02/14/2020, 4:38 PM

hello, Im having problems setting UP SSO. the callback is retuning a blank page, and when its using OKTA it just redirect back to the login page. anyone here that has setup okta with Kolide

vaar

02/18/2020, 11:02 AM

when I enable a pack on kolide, what is the default time when this pack is propagated to the osquery agents? and where I can configure it?

Sal

02/18/2020, 8:28 PM

@zwass, Thanks. I think I'll remove the two config vars from the TLS/Fleetctl config for the meantime and see how that pans out. Thanks for check in on that.

02/25/2020, 4:20 PM

Hi, I'm trying to use package-builder to build a windows launcher package. I've installed wixtoolset, git, make and golang via choco on a windows 10 machine. 'make deps' completes successfully with a warning about possibly not having the latest version for tuf, but I'm assuming this isn't a show stopper:

Copy code

Reading makefiles...
Updating makefiles....
Updating goal targets....
 File 'deps' does not exist.
   File 'deps-go' does not exist.
  Must remake target 'deps-go'.
go run cmd/make/make.go -targets=deps-go,install-tools
  Successfully remade target file 'deps-go'.
   File 'generate' does not exist.
  Must remake target 'generate'.
go generate ./pkg/packagekit ./pkg/packaging
go run cmd/make/make.go -targets=generate-tuf
time="2020-02-25T10:59:58-05:00" level=warning msg="Error while downloading remote metadata, using cached timestamp - this might not be the latest version available remotely"
  Successfully remade target file 'generate'.
Must remake target 'deps'.
Successfully remade target file 'deps'.

Then attempting to run 'make package-builder' gives the following output:

Copy code

c:\Users\jfeat\go\src\<http://github.com|github.com>\kolide\launcher>make package-builder
go run cmd/make/make.go -targets=deps-go,install-tools
go generate ./pkg/packagekit ./pkg/packaging
go run cmd/make/make.go -targets=generate-tuf
go run cmd/make/make.go -targets=package-builder -linkstamp
ts=2020-02-25T16:17:05.0493957Z caller=logutil.go:13 severity=info msg="Target Failed" err="getVersion: git describe: run command git [describe --tags --always --dirty], stderr=: exec: \"git\": executable file not found in %PATH%" target=package-builder
exit status 1
make: *** [Makefile:105: package-builder] Error 1

Can anyone suggest what the problem might be?

joe_antony1

02/25/2020, 6:07 PM

./fleetctl config set --address https://127.0.0.1:8080 --tls-skip-verify [+] Set the address config key to "https://127.0.0.1:8080" in the "default" context [+] Set the tls-skip-verify config key to "true" in the "default" context ./fleetctl login Log in using the standard Fleet credentials. Email: user1@user.com << same as kolide login email Password: error logging in: POST /api/v1/kolide/login: Post https://127.0.0.1:8080/api/v1/kolide/login: dial tcp 127.0.0.18080 connect: connection refused i'm always getting this err.... is there an alternative to edit the fleet configuration ??

Tony N

02/25/2020, 9:15 PM

Hi, I have a quick question regarding connecting a workstation to a Fleet server. I've setup my "flags" file and am pointing to the shared secret, the TLS certificate, and the IP address of the server. However, when I run the osqueryd app I get the following error: cpp:108] Cannot read TLS server certificate(s): "c:\Program Files\osquery\kolide.pem" Any thoughts on what I'm missing? Does the certificate file have to have a certain format?

Jerome

02/27/2020, 10:55 AM

Do you know what can cause the error

PermissionDenied desc = Forbidden: HTTP status code 403

(complete log posted in thread) ? I've build kolide launcher on a macmini and I have this error. Few days ago, I've done it on a test mac machine and it works and still working. I've copied the exact same files to the macmini and still have the issue. Thus, it seems related to the machine but I can't figure out what is wrong